Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

12
votes
2answers
1k views

Is there any advantage of bcrypt over multiple iterations of SHA-x/MD5?

I know that a good password hashing algorithm should be slow. MD5, SHA256, etc. are fast. So I've been adding multiple iterations of SHA-256 hashing to my web apps (around 50000). Getting the hash of ...
2
votes
4answers
5k views

LDAP vs MySQL for Usernames and Passwords

I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
31
votes
4answers
7k views

Security of passphrase-protected private key

If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
8
votes
4answers
2k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
4
votes
3answers
527 views

Hashed passwords - How many variations of rainbow tables?

First off...I passed the CISSP exam. WOOOO. I had to get that out. GCIH and CEH by Sept. 11' So, while studying for the technical side of things, I see that there are rainbow tables. They are ...
20
votes
4answers
2k views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
-1
votes
1answer
4k views

How can I avoid sending passwords in plain text when logging into a website?

Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
3
votes
1answer
2k views

Will using unicode chars in my password increase security? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Bruteforce tries cracking the hash with every possible combination of letters. Then, If ...
25
votes
4answers
4k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
50
votes
6answers
8k views

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
29
votes
6answers
35k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
414
votes
22answers
87k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
14
votes
6answers
2k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
7
votes
3answers
313 views

Should I restrict access to the username and passwords in a web app?

I'm starting to write my first serious web application and am thinking about how to store username and password information. There are plenty of articles detailing how storing plain text passwords is ...
31
votes
8answers
5k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
22
votes
3answers
2k views

How can we accurately measure a password entropy range?

I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
8
votes
3answers
833 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
9
votes
1answer
451 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
7
votes
2answers
810 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
19
votes
2answers
5k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ) } But ...
6
votes
3answers
1k views

Using Secure Remote Password without sending the username in the clear

To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
5
votes
1answer
345 views

Using Secure Remote Password without embedding the modulus

The SRP protocol as described by the author assumes that the large safe prime modulus and generator are embedded into the client and server rather than being transmitted as part of the protocol. ...
11
votes
2answers
429 views

What problems does this “recover account” procedure have?

On a website I run I have implemented this procedure for account recovery (forgotten password procedure). I would like to know whether there are any issues with it that I have not spotted, that make ...
15
votes
2answers
1k views

How does varying character type increase strength of password?

When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password? There ...
7
votes
6answers
3k views

Is denying login after incorrect attempts ineffective?

Generally denying login attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicious login attempts. Yet, surely doing this is ...
8
votes
5answers
519 views

Oldest security feature still in active use

Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
7
votes
4answers
5k views

How to implement a “Remember me” on a mobile app?

I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience, ...
14
votes
3answers
4k views

Should security question answers be case-sensitive?

Question In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers? Scenario An ...
7
votes
2answers
440 views

PKCS#5 Salt privacy? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? In the official documentation of the PKCS5 V2.0 standard, we can read "The salt can be viewed as an index into a ...
3
votes
0answers
201 views

Checking whether a password is derived from previous passwords [duplicate]

Possible Duplicate: How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? On a system I used several years ...
46
votes
9answers
4k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
48
votes
7answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
16
votes
4answers
363 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
108
votes
4answers
27k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
18
votes
6answers
1k views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
14
votes
6answers
679 views

Primary Key as Salt?

Is it okay to use the primary key as the salt in a Users table? The only disadvantage that I can see is if the PK changes (unlikely), then the passwords break. What are your thoughts?
8
votes
3answers
2k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
11
votes
3answers
3k views

Additional security of keyfile on top of a master password for KeePass

I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model. However my biggest remaining concern is the ...
16
votes
4answers
1k views

How are browser saved passwords vulnerable?

Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages ...
68
votes
7answers
72k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
8
votes
3answers
2k views

time to crack file-encryption password - more than just iteration

I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
27
votes
3answers
6k views

Password manager vs remembering passwords

I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager. Some ...
4
votes
2answers
2k views

Cisco IOS question - password management, service password encryption types

I'm university student studying for my certification exam, and I was doing some reviewing today when I found a question that I can't find an answer to. Basically, in the CCNA3 2.4.1 Cisco Netacademy ...
10
votes
2answers
1k views

Stretching a hash, many iterations versus longer input string

I have been reading up on various password hashing schemes, for example the SHA-based Crypt proposed by Ulrich Drepper and used in some Linux versions. A recurring theme here is to 'strengthen' or ...
11
votes
4answers
826 views

Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?

For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
116
votes
6answers
45k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
5
votes
4answers
5k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
23
votes
5answers
3k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
32
votes
2answers
14k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...